Security Review automates checking many of the configuration errors that lead
to an insecure Backdrop site and looks for existing vulnerabilities and attack
attempts.
The primary goal of the module is to elevate your awareness of the importance of
securing your Backdrop site. The results of some checks may be incorrect depending
on unique factors, this module does not make your site more secure. You should
use the results of the checklist and its resources to manually secure your site.
Refer to the support section below if you are interested in securing your Backdrop
site.
Installation
Place the security_review directory and its contents under sites/all/modules or
under an appropriate sites/ directory if you are using Backdrop's multisite
capabilities.
Enable the module at Administer >> Modules and refer to the following sections
for configuration and usage.
Configuration
Two permissions are provided and required to use the module. Navigate to
Administer >> People >> Permissions to enable
'access security review list' and 'run security checks' for trusted roles.
NOTICE: This module provides information on the state of your site's security so
it is imperative you grant these permissions to trusted roles and users only.
For instance, if you have an admin role, be sure that all the users who have
been granted this role are indeed users you trust if you grant them these
permissions.
After you have granted permissions to the module you should inform the system
what roles are not trusted. Navigate to
Administer >> Reports >> Security Review >> Settings to mark which roles are
untrusted. Most checks only care if the resource is usable by
untrusted roles.
On this page you can also define the level of logging. The result
of the last checklist is always stored but you can enable watchdog logging of
each check if you like.
Usage
Navigate to Administer >> Reports >> Security Review to run the checklist.
If a check is enabled it will be run. You can enable or skip a check on this
page only after it has been run. Clicking on the 'Help' link beside each check
will provide details on why the check exists and what was found on the last run.
Drush Usage
Running the Security Review checklist using Drush is a great way to build
automated security audits of your site into your site development lifecycle and
as part of continuous integration.
With the module installed invoke drush secrev from within your Backdrop root.
Call drush help secrev to see available options.
For running specific checks pass the --check option. Be sure to remove any
whitespace characters separating check names.
Consult implementations of hook_security_checks() for exact list of available
check options. Standard Security Review checks are:
file_perms, input_formats, field, error_reporting, private_files, query_errors,
failed_logins, upload_extensions, admin_permissions, untrusted_php,
executable_php, base_url_set, temporary_files
For custom checks you may prefix the check name with the module name and
colon (:) character. For example:
drush secrev --check=my_module:my_check
Note, custom checks require that its module be enabled. Also, should you be
skipping any check the 'store' option will not allow that check to be run.
Site Audit Usage
Security Review also integrates with https://www.drupal.org/project/site_audit ,
a static site analysis platform that generates reports with actionable best
practice recommendations. Security Review can be installed on an entire
platform, eliminating the need for module installation.
To use, put Security Review either in your codebase or in your Drush command
locations, then:
# Clear Drush cache. drush cc drush # Audit security. drush audit_security
Marking field content as known to be safe
The "Dangerous tags in content" check may indicate problems with fields that
you known are safe. You can create a list of field contents and entities
that you want to be skipped in future runs by creating a SHA-256 hash of the
entity_id, entity_type, and field contents. See security_review_check_field
function in security_review.inc for details.
Support
Please use the issue queue at https://github.com/backdrop-contrib/security_review/issues for all
module support. You can read more about securely configuring your site at
https://github.com/backdrop-contrib/security_review/
Current Maintainers
- Herb v/d Dool https://github.com/herbdool
- Seeking additional maintainers.
Credit
Ported to Backdrop by Herb v/d Dool https://github.com/herbdool.
Security Review module written by Benjamin Jeavons, drupal.org user coltrane,
with thanks to Greg Knaddison, drupal.org user greggles, for the idea and
mentorship.
Acquia https://wwww.acquia.com supports the orginal Drupal 7 version of this module.
License
This project is GPL v2 software. See the LICENSE.txt file in this directory for
complete text.